Experimental extraction of secure correlations from a noisy private state 
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We report experimental generation of a noisy entangled four-photon state that exhibits a separa- 
tion between the secure key contents and distillable entanglement, a hallmark feature of the recently 
established quantum theory of private states. The privacy analysis, based on the full tomographic 
reconstruction of the prepared state, is utilized in a proof-of-principle key generation. The inferi- 
ority of distillation-based strategies to extract the key is demonstrated by an implementation of an 
entanglement distillation protocol for the produced state. 



Quantum entanglement can guarantee secure commu- 
nication as demonstrated by Ekert's protocol [l[ for quan- 
tum key distribution Q (QKD), where the random key 
obtained from a maximally entangled state is known ex- 
clusively to legitimate users. A natural way to realise 
QKD using imperfect noisy entanglement is to attempt 
its distillation into the maximal form using local oper- 
ations and classical communication Q. This strategy 
however may reduce the attainable key length or even 
preclude its generation altogether, which follows from the 
recently developed theory of private quantum states 
The secure key can be extracted in general at higher rates 
than that implied by distillable entanglement, and even 
from certain classes of bound entangled states. 

In this Letter we report experimental generation and 
utilization of a noisy entangled four-photon state that 
exhibits the separation between secure key contents and 
distillable entanglement. We perform a full tomographic 
reconstruction of the produced state using the maximum- 
likelihood [f| and Bayesian reconstruction methods 0, 0] , 
which allows us to obtain credible estimates for the quan- 
tities of interest despite their nonlinear character and 
high sensitivity to statistical noise and experimental im- 
perfections. We present a proof-of-principle extraction of 
a secure key and implement an entanglement distillation 
protocol verified to perform suboptimally. 

The original example of extracting privacy from quan- 
tum entanglement is Ekert's QKD protocol, in which two 
communicating parties — Alice and Bob — need a sequence 
of bipartite systems prepared in a maximally entangled 
two-qubit state such as |</>+) = (| 00) + |11)). Lo- 
cal projections performed by Alice and Bob in the com- 
putational basis |0),|1) yield perfectly correlated ran- 
dom key bits. The security is checked by measuring 
the qubits in superposition bases to test coherence be- 
tween the components |00) and |11). If the state used 
for QKD is indeed pure, the monogamy of entangle- 
ment prevents an eavesdropper Eve from learning 
measurement outcomes obtained by legitimate users. Of 
course, a state |c/>_) = 771 (|0Q) — would be equally 



suitable for key generation. But an equiprobable sta- 
tistical mixture of \<j)+) and \4>~) ensures no security. 
This is because it can be viewed as a partial trace 



tripartite state 
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involving a qubit E in possession of Eve, who can gain 
complete information about the results of Alice's and 
Bob's measurements in the computational basis without 
introducing any disturbance. 

Suppose now that in addition to qubits A and B, Alice 
and Bob possess also qubits A' and B' prepared jointly in 
a statistical mixture of \4>-)ab ® \00) a>b' and \4>+)ab (8 
|11)a'B'- Obviously, a local measurement of A' or B' 
in the computational basis reveals whether the qubits A 
and B have been prepared in \(f>+) or \4>~) . This enables 
key generation and entanglement distillation with equal 
rates. An intriguing case is the privacy of a mixed four- 
qubit state 
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where g~ = \ip-) (ip-\, Q+= |(1 — IV'-) O'-Di and we 
denote \tp±) = -^(|01)±|10)). Unlike the preceding ex- 
ample, the two operators g± B cannot be discriminated 
unambiguously by Alice and Bob using local operations 
and classical communication, which lowers the value of 
distillable entanglement Ejj [9(. This can be seen from 
an upper bound 



E D < C = \og 2 Tv\g 
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= log 2 3 



1 « 0.585, 



(3) 



where C is the log-negativity [10( calculated for the par- 
tial transposition r with respect to the partition AA' : 
BB'. In contrast, the theory of private states [1] — of 
which p priv is an example — shows that results of project- 
ing qubits A and B in the computational basis cannot 
be learnt by Eve, thus providing one bit of a secure key. 
This leads to a gap between the key rate and Ed, imply- 
ing general sub-optimality of distillation strategies. 
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Figure. 1. Experimental setup, (a) Preparation of noisy pri- 
vate states. Two maximally entangled photon pairs are gen- 
erated in two nonlinear crystals XX, collected from four direc- 
tions A ABB' shown in the inset, and subjected to polariza- 
tion transformations implemented with quarter-wave plates 
QWP and half- wave plates HWP. D, Soleil-Babinet compen- 
sators; IF, interference filters; SMF, single-mode fibers, (b) 
Polarization analyzers. PBS, polarizing beam splitter; MMF, 
multi-mode fibers; APD, avalanche photodiodes. 



In order to demonstrate experimentally this hallmark 
feature of private states we generated a noisy entangled 
four-photon states using a setup shown in Fig. [TJ Its 
heart were two 1 mm long type-I down conversion beta- 
barium borate crystals with optical axes aligned in per- 
pendicular planeSjfollowing the arrangement introduced 
by Kwiat et al. The crystals were pumped using 

Tksapphire oscillator (Coherent Chameleon Ultra) emit- 
ting a 78 MHz train of 180 fs pulses frequency doubled in 
a 1 mm long lithium triborate crystal to give a 390 nm 
wavelength pump of an average power of 200 mW, and 
focused to a 70 pm diameter waist. The axial symmetry 
of type-I down-conversion implies that photons emerging 
along any two opposite ends of the emission cone will be 
maximally entangled. That way one can collect multi- 
ple photon pairs, as shown in the inset of Fig. [Ija), an d 
obtain a four-photon state \<j)+) AB ® \4> + ) A , B , with |0) 
and |1) corresponding to horizontal and vertical polar- 
izations. Collimated photons after transmission through 
10 nm full-width-at-half-maximum bandwidth interfer- 
ence filters were coupled into single-mode fibers wound 
on manual polarization controllers. Phase relations be- 
tween two-photon probability amplitudes were controlled 
by two Soleil-Babinet compensators D placed in the path 
of the pump beam and photons A. 

Photons B were sent through a half-wave plate whose 
two selected orientations introduced a transformation 
a x = |0) (1| + |1) (0| or a z = |0) (0| - |1> (1|. The set of 



two quarter-waveplates and a half-wave plate placed in 
the path of photons B' realized one of four operations 1, 
u x , <J Z , or u y — iu x a z . Applying combinations erf (8 <jy , 

erf ® I s , <rf £§> erf , and erf ® af randomly with equal 
probabilities produced ideally the state 
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equivalent up to a local unitary to g pr iv The secure 
key can be obtained by measuring qubits A and B in 
the eigenbasis of a y given by \v) — — (|0) + i(—l) v \l)), 
v = 0, 1. 

The photons were detected using free space polariza- 
tion analyzers constructed from a quarter- wave plate, a 
half-wave plate and a Wollaston polarizer with two out- 
put ports coupled into multimode fibers, connected to 
single photon counting modules SPCM (Perkin-Elmer 
SPCM-AQRH), as shown in Fig.QJb). Detection efficien- 
cies within each polarization analyzer, determined from 
an independent macroscopic measurement, were equal- 
ized in the postprocessing by binomial resampling. Elec- 
tric signals from SPCMs were registered with a field pro- 
grammable gate array (FPGA) circuit using a coinci- 
dence window of 6 ns. Typical count rates were 10 5 s _1 
for single counts, 6 x 10 3 s -1 for two-photon and 2 s" 1 
for fourfold coincidences. 

Assuming that only four-photon events are available 
to Alice and Bob, we reconstructed a density matrix of 
a private state and performed a proof-of-principle secure 
key generation. A complete measurement consisted of a 
sequence of 33637 intervals, each 10 s long. Before a sin- 
gle interval, settings of individual polarization analyzers 
were selected randomly and independently on Alice's and 
Bob's side to project polarization in the eigenbasis of a x , 
a y , or o~ z . The density matrix of the generated state was 
reconstructed from fourfold coincidences using two inde- 
pendent techniques: the Kalman filter (KF) method 
based on gaussian approximation and Bayesian inference 
which provides an a posteriori probability distribution on 
the set of density matrices, and the maximum-likelihood 
(ML) method with physical constraints In the KF 
approach the resulting a posteriori distribution served 
to generate a sample of 10 4 physical density matrices 
with the help of the slice-sampling technique [12j. This 
sample was used to calculate mean values and standard 
deviations of individual elements of the density matrix 
depicted in Fig. [51 as well as the information-theoretic 
quantities reported in Eq. ([7]) . Uncertainties of ML esti- 
mates were obtained by generating 2000 reconstructions 
using perturbed experimental data as an input. The 
uncertainties calculated account for both the Poissonian 
photon counting noise and 0.25° uncertainty of the wave- 
plate orientation in polarization analyzers. Calculation of 
the KF a posteriori distribution took 20 s on a standard 
PC, a significant advantage compared with 20 min for 
the ML method. A more time consuming stage, however, 
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Figure. 2. Reconstructed private state, (a) absolute values of 
density matrix elements in the a y basis reconstructed using 
KF method, (b) diagonal KF values (orange, with error bars) 
compared with the ML results (yellow). 



was generation of statistical samples of physical density 
matrices, which took 2 s per matrix using the KF dis- 
tribution and required repetition each time of the full 
reconstruction in the ML case. 

Fig. [5] depicts the state g exp obtained using the KF 
method. The fidelity T = Tr ( y/^/gid g oxp ^/ftd) of this 
state is Jkf = 0.9724(7), and the ML value J'ml = 
0.9715(7) lies within the confidence interval. The figure 
shows that the qubits A and B are indeed strongly corre- 
lated in the basis |0), |1). To characterize the privacy of 
these correlations, we consider a purification |<3>) aa'bb'e 
of the complete system AA'BB'E in the worst-case 
scenario when Eve controls all environmental degrees 
of freedom E. Thus g cxp = Tt e (\^) AA , BB , E (^\), 
which generalizes Eq. (JlJ. After Alice projects the 
qubit A onto a state |o), the state of Bob's qubit 
reduces to = ^-Tr^ S / B ( j4 (a|*) AA , BB , iJ (*|a) A ), 

while Eve is in possession of a system in a state 

(a) 

Qe 



= ^Tr 

p. 



A'BB' [A 



[am 



i AA'BB'E^\ a ) 'A), where p a = 
Tr^/ bb> aa' bb' fi(*l a ) a) is the probability of 
obtaining the projection onto \a) by Alice. An attempt 



to gain information about Alice's outcome by either Bob 
or Eve can be viewed as a classical to quantum com- 
munication channel A — > B or A — > E 13]. In such a 
scenario — denoted as cqq — Alice and Bob can establish 
a secret key at a rate at least 



X c 



Xb ~ Xe, 



(5) 



where xb(e) is the Holevo quantity [1J] for the respective 
channel A — » B(E), defined as: 



Xb(e) 



= S 



\ a / a 



(6) 



S(-) denotes the von Neumann entropy, and the summa- 
tions are carried out over an orthonormal basis of states 
| a), in our case |0) and |1). 

Based on measured data, the Bayesian a posteriori dis- 
tribution for density matrices yields the following esti- 
mates for the attainable key rate and the log-negativity 



A£1 q = 0.690(7), 



C 



KF 



0.581(4). 



(7) 



These results show a clear separation, exceeding ten stan- 
dard deviations, between distillable entanglement and 
the key rate, exposing a fundamental feature of gen- 
eral private states. The ML method yields consistent re- 
sults = 0.704(7) and C M h = 0.578(4). The slightly 
higher value of may be attributed to the fact that 
the ML method returns a lower-rank density matrix with 
weaker entanglement between the system AA' BB' and 
the environment E. 

The consistency of KF and ML results was verified 
by calculating the Mahalanobis distance between the 
density matrices produced by both the methods with the 
KF covariance matrix used as a metric. The obtained dis- 
tance 16.8 is below the value 17.1 corresponding to a 95% 
confidence interval. The KF method allows one to check 
for the presence of systematic errors: since the mean of 
the a posteriori distribution is not forced to be positive 
definite, its Mahalanobis distance from the mean of the 
distribution with imposed positivity constraints is an in- 
dicator of possible systematic errors in the measurement 
process 0- For our data this distance is 17.7, implying 
that systematic errors are not significant. 

In order to extract a secure key from the four photon 
state we selected randomly one event from each interval 
when both the qubits A and B were measured in the 
o~y bases obtaining N — 3716 raw key bits. We simu- 
lated a binary interactive error-correction procedure [lfl 
exchanging 990 parity bits, which corrected all errors, 
and performed privacy amplification using two-universal 
hashing functions. Using the KF estimate of Eve's knowl- 
edge in the asymptotic limit given by xe, conservatively 
enhanced by five standard deviations, and adding a secu- 
rity margin [l6[ to guarantee that the probability of Eve 
learning at least one bit of the key is below 10 -6 , yields 
2164 bits of a secure key. 
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Figure. 3. Two-qubit AB state, (a) Absolute values of the elements of the reduced density matrix obtained by tracing out 
qubits A' and B' . (b,c) Absolute values of the elements of density matrices conditioned upon finding qubits A' and B' in 
identical (b) or orthogonal (c) states when measured in the same basis. 



The subsystems A' and B' play the role of a shield pro- 
tecting the private key contained in subsystems A and 
B from an eavesdropping attempt. Given gid, tracing 
out A' and B' reduces the qubits A and B to a mixed 

state qab = \\4>-) ab (</>- 1 + \\^+) ab^+V The cor- 
responding experimental state, shown in Fig. |3][a), has 
= —0.009(4), which demonstrates that the shield is 
critical to ensure security. The shield qubits can be used 
to implement a simple entanglement distillation proto- 
col for gid: if A' and B' are projected in the same ba- 
sis, identical outcomes collapse the state of qubits A and 
B to a maximally entangled state | ab, while oppo- 
site results produce a separable state 5 (I^-)ab(^-I + 
\1>+)abQ>+\) = !(P>ab<00| + |11) ab ( n l) ^eless for 
key generation. Fig. [3]Jb,c) depict experimental condi- 
tional density matrices reconstructed for these two cases 
using the KF method. The key rate is positive only for 
identical outcomes and equals 0.693(9), which multiplied 
by the relative frequency of these events 0.511 yields the 
average value = 0.354(5), falling significantly be- 

hind the result reported in Eq. ([7]). Using the resulting 
subset of qubit pairs to generate a key under the same se- 



QKD protocols that make optimal use of realistic imper- 
fect resources. 
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